gflow-cli 0.57.0__tar.gz → 0.57.1__tar.gz

{gflow_cli-0.57.0 → gflow_cli-0.57.1}/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gflow",
-  "version": "0.57.0",
+  "version": "0.57.1",
   "description": "Reusable development and operations workflows for gflow-cli",
   "author": {
     "name": "Flavio Oliva",

{gflow_cli-0.57.0 → gflow_cli-0.57.1}/CHANGELOG.md

@@ -7,6 +7,73 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.57.1] — 2026-08-14
+
+### Fixed
+
+- **`gflow video`/`image` can no longer get stuck behind Flow's expanded chat
+  sidebar (#493).** Expanding the sidebar removes the classic composer
+  **entirely** — no `crop_*` settings trigger *and* no Agent pill — which is
+  exactly the fingerprint reported in #493 ("no `crop_*` settings button", "the
+  Agente pill matches neither selector"). It also explains the exit code: with
+  no agentic indicator on screen either, the cohort detector matches nothing, so
+  the run dies as `UiSelectorDriftError` (exit 23) instead of the retryable
+  agentic error (25). Recovery hinged on a single selector scoped to the
+  sidebar's `edit_square` affordance; a cohort whose sidebar lacks that ligature
+  never found the X, so the sidebar never closed and the composer never came
+  back. `ensure_media_mode` now falls back to an unscoped close **only** from
+  the demonstrably stuck state (no `crop_*` **and** no pill), where the classic
+  composer is gone and there is nothing else a close button could belong to.
+  Reproduced live and A/B-proven: with the scoped selector neutered the fallback
+  recovers; with both neutered it does not.
+
+- **`--duration` now fails fast instead of masquerading as UI drift (#451, #288).**
+  Flow's video settings popover is **model-conditional**: only `omni-flash` renders
+  a `4s/6s/8s/10s` row, and the Veo 3.1 models render **no duration control at all**
+  — verified live on two accounts and two locales. `api/video.py` had claimed "the
+  four `VEO_3_1_*` models cap at 8s", which presumed a control that is never drawn,
+  so `_select_video_duration` hunted a missing element and died with
+  `UiSelectorDriftError` (exit 23) after ~30 s. That is why the bug reproduced
+  identically on playwright 1.59 and 1.61 (the version bound was correctly
+  exonerated) and why the locale hypothesis was refuted — it was never either.
+  `--duration` with a Veo model now exits **2 before any browser work**, naming the
+  model and the fix. New `VideoModel.supports_duration()`; the DTO guards it too, for
+  API callers.
+- **`--reference-entity` no longer advertised on `video i2v`, where it always failed.**
+  The flag was registered on `t2v`/`i2v`/`r2v`, but `_validate_i2v_symmetry` rejects
+  reference entities on i2v — so the i2v form raised for every caller who believed
+  the help text. It is now applied to `t2v`/`r2v` only. The reverse error was in the
+  docs: `REFERENCE_STRATEGIES.md`, `USAGE.md` and the `t2v` help text all stated "the
+  video path has no `--reference-entity` flag" while `cli_video.py` registered it —
+  corrected in all four places.
+- **A named remote reference that isn't in the picker now raises a typed error.**
+  `--ref-name` searches Flow's picker, which indexes Flow's own short auto-caption —
+  not the generation prompt — so a prompt passed as `--ref-name` surfaced as a bare
+  Playwright `TimeoutError` after 8 s, with no exit code to branch on and no hint
+  that the *name* was the problem. Now `ReferenceNotFoundError` (**exit 32**), listing
+  what the picker actually offered.
+- `reference_cap_for` now records the live-verified ingredient rule it already
+  encoded: `veo-quality` refuses image ingredients (Flow: "You cannot use image
+  ingredients with this model") while Omni Flash / Fast / Lite accept them, and a cap
+  of 0 *is* the answer to "does this model take ingredients?". Deliberately no second
+  predicate — one was written, found to have no production caller, and deleted.
+
+- **MCP `gflow_generate_image` `ui_mode` now matches the video tool's contract.**
+  The image tool rejected an unknown `ui_mode` with a flat `error` **string**, so a
+  client reading `error["title"]` — the RFC 9457 shape every other 400 from these
+  tools uses since #498 — crashed with `TypeError: string indices must be integers`.
+  It was also case-sensitive, while the CLI's `--ui-mode` is
+  `click.Choice(case_sensitive=False)` and the video tool normalizes. Both are fixed:
+  the value is lower-cased and an invalid one returns the standard problem-details
+  envelope. Found by `/code-review` against docs that asserted the param "mirrors the
+  CLI" — it did not.
+- **`GFLOW_MCP_NO_SPEND` documentation corrected (no behavior change).**
+  [CONFIGURATION](docs/CONFIGURATION.md) described the falsy set as a literal lowercase
+  list, so a reader setting `GFLOW_MCP_NO_SPEND=FALSE` would conclude no-spend was
+  **on** when the value is lower-cased before comparison and it is **off**. On the one
+  variable whose purpose is a hard guarantee against spending credits, the wrong
+  reading failed toward spending. Now states the match is case-insensitive.
+
 ## [0.57.0] — 2026-08-14
 
 ### Added
@@ -2910,7 +2977,8 @@ shell-script template that branches on these codes.
 
 First skeleton. Not functional end-to-end yet.
 
-[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.57.0...HEAD
+[Unreleased]: https://github.com/ffroliva/gflow-cli/compare/v0.57.1...HEAD
+[0.57.1]: https://github.com/ffroliva/gflow-cli/compare/v0.57.0...v0.57.1
 [0.57.0]: https://github.com/ffroliva/gflow-cli/compare/v0.56.0...v0.57.0
 [0.56.0]: https://github.com/ffroliva/gflow-cli/compare/v0.55.0...v0.56.0
 [0.55.0]: https://github.com/ffroliva/gflow-cli/compare/v0.54.0...v0.55.0

{gflow_cli-0.57.0 → gflow_cli-0.57.1}/KNOWN_ISSUES.md

@@ -181,31 +181,53 @@ accepted. Two corrections fixed it (verified end-to-end on macOS Apple Silicon):
 
 Evidence: [LIVE_VERIFICATION_v0.23.0](docs/LIVE_VERIFICATION_v0.23.0.md).
 
-### New Flow editor variant (composer frame slots + Agent toggle) is not recognized
+### Expanded chat sidebar left the composer unrecoverable (exit 23)
 
-- **Status:** **Open** — awaiting a DOM signature from an affected account;
+- **Status:** **Resolved** in the unreleased line — fixed and A/B-verified live;
   tracked in [#493](https://github.com/ffroliva/gflow-cli/issues/493)
-- **Severity:** High · **Affects:** `gflow image` / `gflow video` generation on
-  accounts that received the new editor, any locale
-
-A third Flow editor layout was reported on 2026-08-13 (macOS, v0.55.0; also
-v0.53.1): frame-slot buttons ("Initial"/"Final") sit directly on the composer
-next to an "Agent" pill, and there is **no** classic `crop_*` aspect/settings
-button for gflow to drive. The layout matches **none** of the known cohort
-indicators (agentic chat composer, full-page media library), so the mode-switch
-step falls through to `UiSelectorDriftError` (**exit 23**) instead of the
-retryable exit-25 cohort classification. The selector cascade itself is
-locale-invariant — the reporter's Portuguese UI is unrelated.
-
-The error detail now names this hypothesis and the run writes a PII-safe DOM
-signature to `diag_mode_switch_miss.json` when it can be captured (structural
-allowlist: ligature names, tag counts — no cookies, tokens, prompts, or page
-text; if the file is absent, attach the incident bundle instead — its
-`ui.json` carries the same DOM signature). **If you hit this, attach that JSON file to
-[#493](https://github.com/ffroliva/gflow-cli/issues/493)** — recognizing the
-variant (and restoring a clean retryable classification, or full support) needs
-exactly that DOM signature. Re-running later may land the classic editor if
-the rollout is still an A/B arm.
+- **Severity:** High · **Affected:** `gflow image` / `gflow video` generation on
+  accounts whose chat sidebar lacks the `edit_square` affordance, any locale
+
+Reported 2026-08-13 (macOS, v0.53.1 and v0.55.0) as an unrecognized "third
+editor variant": frame-slot buttons ("Inicial"/"Final") on the composer next to
+an "Agente" pill, and **no** classic `crop_*` settings button.
+
+**Root cause (2026-08-14, reproduced live at zero credits):** there is no third
+variant. Those are stock classic-composer features — "Inicial"/"Final" are the
+**Frames** sub-mode's Start/End slots, and the Agent pill sits alongside the
+classic popover. The real trigger is Flow's **expanded chat sidebar**, which
+removes the classic composer *entirely*:
+
+```
+in sidebar state ->  crop_* triggers = 0    Agent pill = 0
+```
+
+One state, both reported symptoms. It also explains the exit code: with no
+agentic indicator on screen either, the cohort detector matches nothing, so the
+run fails as `UiSelectorDriftError` (**exit 23**) rather than the retryable
+exit-25 classification. The Portuguese UI was unrelated — the cascade is
+locale-invariant (ligature-keyed), re-confirmed on a pt-BR account.
+
+Recovery depended on a single selector scoped to the sidebar's `edit_square`
+("new session") affordance. On a cohort whose sidebar lacks that ligature the
+close button was never found, so the sidebar never closed, the composer never
+returned, and **every** run failed. `mode_control.ensure_media_mode` now falls
+back to an unscoped close, reached **only** from the demonstrably stuck state
+(no `crop_*` **and** no Agent pill) — safe there because the classic composer is
+gone, so nothing else a close button could belong to remains.
+
+Verified by an A/B on a real editor: with the scoped selector neutered the
+fallback recovers; with both neutered it does not. Two earlier hypotheses were
+tested and refuted first (a `crop_free` sub-mode trigger, and a composer
+hydration race) — see
+[the spike evidence](docs/superpowers/spikes/2026-08-14-video-model-capability-matrix.md).
+
+If you still hit exit 23 after upgrading, the run writes a PII-safe DOM
+signature to `diag_mode_switch_miss.json` (structural allowlist: ligature names
+and tag counts — no cookies, tokens, prompts, or page text; if absent, the
+incident bundle's `ui.json` carries the same data). Attach it to
+[#493](https://github.com/ffroliva/gflow-cli/issues/493) — that would indicate a
+state genuinely different from the sidebar one.
 
 ### Flow's new full-page media-library UI breaks entity attach (A/B rollout)
 

{gflow_cli-0.57.0 → gflow_cli-0.57.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: gflow-cli
-Version: 0.57.0
+Version: 0.57.1
 Summary: Unofficial CLI for Google Flow — drive Veo image-to-video generations from the terminal.
 Project-URL: Homepage, https://github.com/ffroliva/gflow-cli
 Project-URL: Issues, https://github.com/ffroliva/gflow-cli/issues

{gflow_cli-0.57.0/website → gflow_cli-0.57.1}/docs/CONFIGURATION.md

@@ -215,8 +215,9 @@ gflow tools run creative-director "cat in space" --json   # check "was_expanded"
 
 **What:** Registration-time gating of the credit-spending MCP tools (#496). When set, `gflow mcp run` and `gflow serve` never register `gflow_generate_image` and `gflow_generate_video`, so a connected agent cannot even see them in `tools/list` — invisible beats refused (no wasted calls, no refusal path for prompt injection to probe, no reliance on the model honoring an error). Every read-only tool stays available.
 **Default:** unset (both generate tools registered).
-**Accepted:** any value other than the falsy set `0`/`false`/`off`/`no`/`n`/`f`/empty enables no-spend. The falsy vocabulary deliberately matches Click's, so a value cannot mean "off" to the `--no-spend` flag and "on" to the server-side policy.
-**Equivalent flag:** `gflow mcp run --no-spend` (and `gflow serve --no-spend`), which sets this variable for you. The env var is the only route that covers a server you did not start yourself — e.g. one launched from an MCP client config. See [MCP § Option A2](MCP.md#4-setup-instructions).
+**Accepted:** the value is lower-cased and stripped before comparison, so the falsy set `0`/`false`/`off`/`no`/`n`/`f`/empty is matched **case-insensitively** — `FALSE`, `Off` and `NO` all leave no-spend **disabled**, exactly like their lowercase forms. Any other value enables it. The falsy vocabulary deliberately matches Click's, so a value cannot mean "off" to the `--no-spend` flag and "on" to the server-side policy.
+**⚠️ Fails toward spending:** an unrecognised *falsy-looking* value is not a safety net — if you want the guarantee, set `GFLOW_MCP_NO_SPEND=1` (or pass `--no-spend`) and confirm the two generate tools are absent from `tools/list`.
+**Equivalent flag:** `gflow mcp run --no-spend` (and `gflow serve --no-spend`), which sets this variable for you. The env var is the only route that covers a server you did not start yourself — e.g. one launched from an MCP client config. See [MCP § Option A2](MCP.md#option-a2-read-only-server).
 **Note:** this is the one variable that does not carry the `GFLOW_CLI_` prefix — it is scoped to the MCP server, not the CLI.
 
 Both generate tools are gated, not just video: image generation is only *empirically* free ("~0 credits observed"), and no-spend is meant to be a hard guarantee.

{gflow_cli-0.57.0 → gflow_cli-0.57.1}/docs/INDEX.md

@@ -134,13 +134,13 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"gflow refuses to open my profile after a downgrade (exit 11, 'written by a newer Chromium')"** → [AUTHENTICATION § Chromium downgrade guard](AUTHENTICATION.md#chromium-downgrade-guard)
 **"Two gflow runs on the same profile — can the second one wait instead of failing (exit 11)?"** → [CONFIGURATION § GFLOW_CLI_LEASE_WAIT_SECONDS](CONFIGURATION.md#gflow_cli_lease_wait_seconds) (v0.56.0 opt-in bounded wait)
 **"How do I silence the 'newer version on PyPI' stderr notice?"** → [CONFIGURATION § GFLOW_CLI_UPDATE_CHECK](CONFIGURATION.md#gflow_cli_update_check) (`0` disables; auto-skipped in CI and for editable installs)
-**"How do I run the MCP server so an agent can't spend credits?"** → [CONFIGURATION § GFLOW_MCP_NO_SPEND](CONFIGURATION.md#gflow_mcp_no_spend) + [MCP § Option A2](MCP.md#4-setup-instructions) (`gflow mcp run --no-spend` / `GFLOW_MCP_NO_SPEND=1`; v0.57.0 — both generate tools go unregistered, not merely refused)
+**"How do I run the MCP server so an agent can't spend credits?"** → [CONFIGURATION § GFLOW_MCP_NO_SPEND](CONFIGURATION.md#gflow_mcp_no_spend) + [MCP § Option A2](MCP.md#option-a2-read-only-server) (`gflow mcp run --no-spend` / `GFLOW_MCP_NO_SPEND=1`; v0.57.0 — both generate tools go unregistered, not merely refused)
 **"Which Flow UI arm does a video run require, and why did it exit 2 or 28?"** → [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode) (v0.57.0 — video is classic-only: `auto` ≡ `classic`, explicit `agentic` exits 2, unreachable classic aborts pre-submit with exit 28, $0)
 **"A gflow command hangs / fails — where do I start?"** → [DEBUGGING § Quick reference](DEBUGGING.md#quick-reference)
 **"A command failed — where is the incident bundle and what's in it?"** → [DEBUGGING § Automatic incident bundles](DEBUGGING.md#automatic-incident-bundles) (layout, triggers, review-before-sharing); privacy boundaries: [SECURITY § Automatic incident bundles](SECURITY.md#automatic-incident-bundles-gflow_cli_incident_capture-default-on); disable via [CONFIGURATION § GFLOW_CLI_INCIDENT_CAPTURE](CONFIGURATION.md#gflow_cli_incident_capture)
 **"Flow's UI broke a selector — how do I diagnose it?"** → [DEBUGGING § Inspecting Flow's live UI](DEBUGGING.md#inspecting-flows-live-ui)
 **"What does each `ui_automation.*` log event mean?"** → [DEBUGGING § Listener & HTTP-layer debugging](DEBUGGING.md#listener--http-layer-debugging)
-**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.57.0](LIVE_VERIFICATION_v0.57.0.md) (**#299 video UI-mode policy + the #496/#497/#498/#501 MCP wave live-verified 2026-08-14 on profile `ffroliva`, ZERO credits** — three real video-editor loads bound the classic driver through `get_ui_driver` [`ui_driver.bound mode=classic`, 1.2–1.7 s, aborted pre-submit], `--ui-mode agentic` is refused with **exit 2 before any browser launch** [deliberately not exit 28, whose "retry may land it" hint would mislead for a driver that does not exist], and a real-editor classic→agent→classic round-trip proved `ensure_agent_mode`'s aria-verified real click [`{"agent_acted":true,"after_agent":"agent","after_media":"media"}`]; the MCP surfaces were driven over the **real stdio JSON-RPC wire** [subprocess `gflow mcp run`, so registration *and* stream routing are covered]: `--no-spend` cut `tools/list` from 11 tools to 9 with both generate tools genuinely unregistered rather than refused, zero-arg `gflow_auth_status` returned `authenticated` off a live `GET /fx/api/auth/session` **200**, `gflow_list_projects` returned **different project IDs** on offset 0 vs offset 2 [proving the offset is honored — catalogs larger than `limit` were previously unreachable] with `limit=0`→1 and `offset=-5`→0 clamps holding, and the known-issues resource served a **7,543-byte index** against a ~70 KB source file with a **111-byte** capped unknown-slug reply. The #498 rate-limited problem-details envelope is recorded **not live-verified with reason** — exhausting the token bucket needs ≥9 accepted generate calls, so the error path cannot be reached credit-free; it is unit-pinned for both tools instead). Prior: [LIVE_VERIFICATION_v0.56.0](LIVE_VERIFICATION_v0.56.0.md) (**#477 downgrade guard, #478 bounded lease wait, and the #493 mode-switch path live-verified 2026-08-13 on profile `denon82`, images only** — a fresh-project 16:9 `t2i` exercised the #493-touched mode-switch path end-to-end [valid `ff d8` JPEG 1376×768, `image_mode_entered` → `batch_response_captured`]; the #477 guard refused a scratch profile claiming Chromium 999 with **exit 11 pre-auth, pre-credits** at the generation-client call site; #478 was proven with three concurrent runs — `WAIT=0` control failed fast with `ProfileLockedError` exit 11 while the holder held, and the `WAIT=180` waiter polled ~11 s past the holder's natural release then generated successfully; the #493 drift branch itself is a named skip [only an affected account's new-editor cohort can reach it — the fix's message text is unit-pinned], and #479's update notice is deferred-with-reason to a post-release check [it needs a published newer version on PyPI and skips editable installs by design]; an expired denon82 session 401'd the first two attempts [external state, re-login fixed it, recorded not omitted]). Prior: [LIVE_VERIFICATION_v0.55.0](LIVE_VERIFICATION_v0.55.0.md) (**Tier-1 quick wins #471–#476 verified 2026-08-13 on profile `ffroliva`, ZERO credits** — `gflow auth status` probed the real Flow session endpoint live [`Flow session verified as ffroliva@gmail.com.`, exit 0, fail-closed contract pinned]; `gflow mcp setup` ran end-to-end with the real CLI against a scratch copy of the real Claude Desktop config [correct merged entry, pristine original]; the Windows profile-DACL two-step `icacls` idiom was derived empirically [the naive `/t` form broke file access] and is pinned by a real-icacls round-trip test on every Windows host; the incident bug-report template, MCP error funnel [all 11 tools guarded, raw exception text masked], and SecretStr settings are suite-verified with no live-Flow surface — reasons recorded, not omitted). Prior: [LIVE_VERIFICATION_v0.54.0](LIVE_VERIFICATION_v0.54.0.md) (**close-browser guidance #470, character-composer focus fix, overlay/jitter hardening, and SonarCloud-S2245 RNG swap live-verified 2026-08-12 on profile `ffroliva`, ZERO credits** — the new #470 login wording printed verbatim and the manual-close → `auth_flow_session_verified` round-trip worked end-to-end; a Classic-UI `t2i` produced a real 1024×1024 JPEG [`ff d8 ff e0`] exercising overlay dismissal + jitter + image-composer submit + mode controller, and a credit-free `character create` [entity `da3cd647…`, face 1376×768 JPEG] exercised the character-composer path directly [`entering_character_editor` → `prompt_submitted` → `entity_patched` → `completed`]; the first `t2i` hit the known agentic-cohort video-for-image condition [correctly refused via `WireFormatError`, tracked by #299, not a regression] and Classic UI worked around it. First mainline release after the orphaned v0.53.0/v0.53.1 tags — CHANGELOG restores honest 0.53.x sections). Prior: [LIVE_VERIFICATION_v0.52.0](LIVE_VERIFICATION_v0.52.0.md) (**batch DAG references #317, character entity provenance recording #402, and video duration selector cascade fix #451 live-verified 2026-08-05** — 3/3 live E2E tests in `tests/e2e/test_entity_provenance_e2e.py` passed clean on profile `ffroliva`, 5-layer evidence ledger verified). Prior: [v0.51.0](LIVE_VERIFICATION_v0.51.0.md) (**dependency/security/test-correctness release verified 2026-08-05, 1 Imagen credit + 1 Veo attempt** — the only change needing live evidence was the `playwright` bound raise `>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0`, and the 2026-08-03 regression does NOT reproduce on 1.61.0: a live i2v drove `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live i2i local-ref attach passed outright [96.7s]. **1.62.0 stays excluded**, never root-caused. `-m e2e_auth` 16/16, daemon e2e 1 passed [MCP over Streamable HTTP — the first live coverage that test has ever had, it was structurally incapable of passing before], MCP Tasks 5/5 layers, 2923 offline tests, `pip-audit --all-extras` clean. **No finished mp4 is claimed** — Flow's own generation returned `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT`, server-side. Defect found and recorded not omitted: Flow dropped the duration-tab UI so **`--duration` is currently broken for i2v**, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0 — [#451](https://github.com/ffroliva/gflow-cli/issues/451)). Prior: [v0.50.0](LIVE_VERIFICATION_v0.50.0.md) (**MCP Tasks extension SEP-2663, non-blocking task handle responses, CLI/MCP output path hardening -o/--output, and Telegram PR triage alert resilience verified 2026-08-04** — 5-layer evidence ledger note generated at `tmp/live-verify/mcp-tasks.md` confirming instant task handle return, working status queries, and cancelled status DB state transitions; full 118-test suite green). Prior: [v0.49.0](LIVE_VERIFICATION_v0.49.0.md) (**#125 `omni-flash` start-frame I2V video generation, Playwright dependency upper-bound pin `>=1.59.0,<1.60.0`, submission stage watchdog timeout, and #404 count-tab fail-closed logic verified 2026-08-03** — 0-credit wire intercept captured `batchAsyncGenerateVideoStartImage` with `startImage` bound; live costed generation on `omni-flash` I2V produced a 1.2MB valid mp4 video asset on `ffroliva`; full 2902-test release suite green). Prior: [v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
+**What was actually live-verified for the latest release?** → latest: [LIVE_VERIFICATION_v0.57.1](LIVE_VERIFICATION_v0.57.1.md) (**#493 and #451/#288 root-caused and fixed from live evidence, verified 2026-08-14 on profile `denon82` (pt-BR — the #493 reporter's locale), ZERO credits** — #493 was NOT an unrecognized "third editor variant": "Inicial"/"Final" are the Frames sub-mode's Start/End slots and the "Agente" pill is the ordinary Agent button, both stock classic features. The real trigger is Flow's **expanded chat sidebar**, which removes the classic composer entirely [`crop_* = 0` AND `Agent pill = 0` simultaneously] — one state producing both reported symptoms, and the reason the failure was exit 23 rather than the retryable 25 [no agentic indicator on screen, so the cohort detector matched nothing]. Recovery hinged on a close button scoped to the sidebar's `edit_square` affordance, a single point of failure for any cohort lacking that ligature; an unscoped fallback now fires only from the demonstrably stuck state, **A/B-proven three ways** [scoped broken + fallback present → rescued; both broken → NOT recovered, which is what proves the fallback rescues rather than the surrounding loop]. #451/#288 were never selector drift either — Flow's settings popover is **model-conditional**, only `omni-flash` renders a duration row, so `--duration` on a Veo model hunted a control that is never drawn [verified on 2 accounts × 2 locales]; it now exits 2 before any browser work. Two #493 hypotheses were tested and **refuted** first and are committed so they are not re-derived [a `crop_free` sub-mode trigger — the trigger reflects the *aspect*, not the sub-mode; and a hydration race — a wait was written, A/B-neutered, and cold loads passed 3/3 BOTH ways, so it was reverted rather than shipped]. Recorded not-verified: the `veo_3_1_lite_lower_priority` picker miss is **inconclusive** [the capture came after the menu closed] so that selector was deliberately left untouched, and `chain.py`'s per-link duration aborts mid-run after billing — deferred with the finding recorded). Prior: [LIVE_VERIFICATION_v0.57.0](LIVE_VERIFICATION_v0.57.0.md) (**#299 video UI-mode policy + the #496/#497/#498/#501 MCP wave live-verified 2026-08-14 on profile `ffroliva`, ZERO credits** — three real video-editor loads bound the classic driver through `get_ui_driver` [`ui_driver.bound mode=classic`, 1.2–1.7 s, aborted pre-submit], `--ui-mode agentic` is refused with **exit 2 before any browser launch** [deliberately not exit 28, whose "retry may land it" hint would mislead for a driver that does not exist], and a real-editor classic→agent→classic round-trip proved `ensure_agent_mode`'s aria-verified real click [`{"agent_acted":true,"after_agent":"agent","after_media":"media"}`]; the MCP surfaces were driven over the **real stdio JSON-RPC wire** [subprocess `gflow mcp run`, so registration *and* stream routing are covered]: `--no-spend` cut `tools/list` from 11 tools to 9 with both generate tools genuinely unregistered rather than refused, zero-arg `gflow_auth_status` returned `authenticated` off a live `GET /fx/api/auth/session` **200**, `gflow_list_projects` returned **different project IDs** on offset 0 vs offset 2 [proving the offset is honored — catalogs larger than `limit` were previously unreachable] with `limit=0`→1 and `offset=-5`→0 clamps holding, and the known-issues resource served a **7,543-byte index** against a ~70 KB source file with a **111-byte** capped unknown-slug reply. The #498 rate-limited problem-details envelope is recorded **not live-verified with reason** — exhausting the token bucket needs ≥9 accepted generate calls, so the error path cannot be reached credit-free; it is unit-pinned for both tools instead). Prior: [LIVE_VERIFICATION_v0.56.0](LIVE_VERIFICATION_v0.56.0.md) (**#477 downgrade guard, #478 bounded lease wait, and the #493 mode-switch path live-verified 2026-08-13 on profile `denon82`, images only** — a fresh-project 16:9 `t2i` exercised the #493-touched mode-switch path end-to-end [valid `ff d8` JPEG 1376×768, `image_mode_entered` → `batch_response_captured`]; the #477 guard refused a scratch profile claiming Chromium 999 with **exit 11 pre-auth, pre-credits** at the generation-client call site; #478 was proven with three concurrent runs — `WAIT=0` control failed fast with `ProfileLockedError` exit 11 while the holder held, and the `WAIT=180` waiter polled ~11 s past the holder's natural release then generated successfully; the #493 drift branch itself is a named skip [only an affected account's new-editor cohort can reach it — the fix's message text is unit-pinned], and #479's update notice is deferred-with-reason to a post-release check [it needs a published newer version on PyPI and skips editable installs by design]; an expired denon82 session 401'd the first two attempts [external state, re-login fixed it, recorded not omitted]). Prior: [LIVE_VERIFICATION_v0.55.0](LIVE_VERIFICATION_v0.55.0.md) (**Tier-1 quick wins #471–#476 verified 2026-08-13 on profile `ffroliva`, ZERO credits** — `gflow auth status` probed the real Flow session endpoint live [`Flow session verified as ffroliva@gmail.com.`, exit 0, fail-closed contract pinned]; `gflow mcp setup` ran end-to-end with the real CLI against a scratch copy of the real Claude Desktop config [correct merged entry, pristine original]; the Windows profile-DACL two-step `icacls` idiom was derived empirically [the naive `/t` form broke file access] and is pinned by a real-icacls round-trip test on every Windows host; the incident bug-report template, MCP error funnel [all 11 tools guarded, raw exception text masked], and SecretStr settings are suite-verified with no live-Flow surface — reasons recorded, not omitted). Prior: [LIVE_VERIFICATION_v0.54.0](LIVE_VERIFICATION_v0.54.0.md) (**close-browser guidance #470, character-composer focus fix, overlay/jitter hardening, and SonarCloud-S2245 RNG swap live-verified 2026-08-12 on profile `ffroliva`, ZERO credits** — the new #470 login wording printed verbatim and the manual-close → `auth_flow_session_verified` round-trip worked end-to-end; a Classic-UI `t2i` produced a real 1024×1024 JPEG [`ff d8 ff e0`] exercising overlay dismissal + jitter + image-composer submit + mode controller, and a credit-free `character create` [entity `da3cd647…`, face 1376×768 JPEG] exercised the character-composer path directly [`entering_character_editor` → `prompt_submitted` → `entity_patched` → `completed`]; the first `t2i` hit the known agentic-cohort video-for-image condition [correctly refused via `WireFormatError`, tracked by #299, not a regression] and Classic UI worked around it. First mainline release after the orphaned v0.53.0/v0.53.1 tags — CHANGELOG restores honest 0.53.x sections). Prior: [LIVE_VERIFICATION_v0.52.0](LIVE_VERIFICATION_v0.52.0.md) (**batch DAG references #317, character entity provenance recording #402, and video duration selector cascade fix #451 live-verified 2026-08-05** — 3/3 live E2E tests in `tests/e2e/test_entity_provenance_e2e.py` passed clean on profile `ffroliva`, 5-layer evidence ledger verified). Prior: [v0.51.0](LIVE_VERIFICATION_v0.51.0.md) (**dependency/security/test-correctness release verified 2026-08-05, 1 Imagen credit + 1 Veo attempt** — the only change needing live evidence was the `playwright` bound raise `>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0`, and the 2026-08-03 regression does NOT reproduce on 1.61.0: a live i2v drove `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live i2i local-ref attach passed outright [96.7s]. **1.62.0 stays excluded**, never root-caused. `-m e2e_auth` 16/16, daemon e2e 1 passed [MCP over Streamable HTTP — the first live coverage that test has ever had, it was structurally incapable of passing before], MCP Tasks 5/5 layers, 2923 offline tests, `pip-audit --all-extras` clean. **No finished mp4 is claimed** — Flow's own generation returned `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT`, server-side. Defect found and recorded not omitted: Flow dropped the duration-tab UI so **`--duration` is currently broken for i2v**, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0 — [#451](https://github.com/ffroliva/gflow-cli/issues/451)). Prior: [v0.50.0](LIVE_VERIFICATION_v0.50.0.md) (**MCP Tasks extension SEP-2663, non-blocking task handle responses, CLI/MCP output path hardening -o/--output, and Telegram PR triage alert resilience verified 2026-08-04** — 5-layer evidence ledger note generated at `tmp/live-verify/mcp-tasks.md` confirming instant task handle return, working status queries, and cancelled status DB state transitions; full 118-test suite green). Prior: [v0.49.0](LIVE_VERIFICATION_v0.49.0.md) (**#125 `omni-flash` start-frame I2V video generation, Playwright dependency upper-bound pin `>=1.59.0,<1.60.0`, submission stage watchdog timeout, and #404 count-tab fail-closed logic verified 2026-08-03** — 0-credit wire intercept captured `batchAsyncGenerateVideoStartImage` with `startImage` bound; live costed generation on `omni-flash` I2V produced a 1.2MB valid mp4 video asset on `ffroliva`; full 2902-test release suite green). Prior: [v0.48.0](LIVE_VERIFICATION_v0.48.0.md) (**#411 predictable `-o`/`--output` paths, offline-verified 2026-08-02, ZERO credits** — exact single-target local writes + `_1`/`_2` multi-count **image** suffixes proven by the CLI suite; the pre-tag council audit [RED, then resolved] re-scoped the release to the truthful surface: a dead MCP `output` param was deleted [worker queue never read it — #414], cloud `-o` targets and video multi-count suffixes are follow-ups [#415], and two tautological video-path tests are recorded as weak evidence rather than claimed as proof; storage-layer S3 writes verified against Docker MinIO at the layer level only; 2888-test release tree green; the live-Flow run aborted pre-generation on an expired denon82 session [`AuthExpiredError` 401, correct RFC-7807 contract + remediation hint, $0] — recorded, not omitted; live re-run queued for the next authenticated session). Prior: [v0.47.0](LIVE_VERIFICATION_v0.47.0.md) (**MCP SDK 2.0.0 migration + dual-era protocol + #402 entity provenance recording live-verified 2026-08-01, ZERO credits** — stdio JSON-RPC initialization handshake verified over subprocess transport, `resolve-drift` CI job added to prevent dependency drift, and 121 unit tests in `tests/data` passed). Prior: [v0.46.1](LIVE_VERIFICATION_v0.46.1.md) (**#404 classic count-setter fix live-verified 2026-07-31 on the reporter's exact environment, ZERO credits** — credit-free DOM recon proved Flow renamed the count-tab labels to uniform `xN` [`x1` replaces `1x`, image AND video rows], that `nth(0)` of the old filtered set landed on the selected `x2` and actively moved the count AWAY from the target, and that a digit-keyed click on `x1` converges instantly and persists without a Save commit; the new classic e2e then passed live [count=1 against a fresh project displaying 2 → exactly 1 image; count=2 early-exit → exactly 2], and the #313 agentic count-enforcement e2e passed 4/4 [counts 1–4 vs deliberately mismatched sticky defaults, magic-byte-verified downloads] after its stale setup was repaired [Flow now loads the editor in classic mode — the setup needed an Agent-pill toggle before the `tune` icon; test-only fix, no product code implicated]; the video output-count cascade carries a recorded waiver [full drive costs Veo credits; its exact selector shape was exercised live in the spike's cleanup step]). Prior: [v0.46.0](LIVE_VERIFICATION_v0.46.0.md) (**#387 provider-agnostic prompt-tools transport live-verified 2026-07-28, ZERO credits** — a four-probe capability spike passed 4/4 against BOTH a non-Google gateway and Google's OpenAI-compat endpoint, including a *semantic* multimodal check [a generated solid-red JPEG round-tripped and the model answered 'Red'], which is what proved the native Gemini `inlineData` path could be deleted outright rather than kept as a fallback; the real CLI then returned `was_expanded: true` on gateway/gateway-no-model/Google-default, emitted the loud one-time notice + no-op for the removed `GFLOW_CLI_GEMINI_API_KEY`, and made NO network call when unconfigured. Live verification caught two defects a fully green 2849-test offline suite missed: Google's compat endpoint has no server-side default model [`400 "model is not specified"`, silently no-oping the DEFAULT configuration], and the first redirect guard did not actually work because `build_opener()` installs its default handlers regardless of arguments, so `Authorization` would still have been replayed cross-host. `/code-review high` is recorded as NOT run — it is user-triggered only). Prior: [v0.45.0](LIVE_VERIFICATION_v0.45.0.md) (**#393 UUID `--ref` binding + #395 character-entity binding live-verified 2026-07-27/28** — a controlled A/B on identical input flipped `--ref` from exit 9 to exit 0 via the catalog-backed upload fallback, with the anti-silence guard [an unbindable ref aborts non-zero and writes no image] pinned by a live e2e; picker DOM + HAR showed Flow indexes a short auto-caption, NOT the prompt, so a prompt-derived search hint was dropped rather than shipped on assumption; a CDP spike against Flow's own character flow then captured the `entityContext` contract that gflow's generations were missing, root-causing #395 to two gflow defects [overlay dismissal Escaping Flow's own composer, and a character-route bounce that sent the prompt to the project composer] — both fixed, both character e2e tests now pass live, including `--format-prompt` [#383], with a read-back confirming the character carries its name and `thumbnail_media_id`). Prior: [v0.44.0](LIVE_VERIFICATION_v0.44.0.md) (**#381 dual-side project management & Playwright Chromium transport live-verified 2026-07-26** — real-editor project creation + rename tRPC server/DOM sync, prompt slugging, `gflow project` subcommand family, HTTP 429 adaptive backoff, and full E2E test suite). Prior: [v0.43.0](LIVE_VERIFICATION_v0.43.0.md) (**private incident diagnostics live-verified 2026-07-23, 1 Veo credit**). Prior: [v0.42.0](LIVE_VERIFICATION_v0.42.0.md) (**#361 production-readiness live-gaps confirmed live 2026-07-21, 1 Veo credit** — a real `veo-lite` t2v through the worker path persisted a real `remote_started` checkpoint [observer→checkpoint→DB chain confirmed], crash-recovery classified the task `indeterminate` without resubmitting, and mid-launch cancellation released the `ProfileLease` credit-free; full evidence in [v0.40.0-production-readiness § "2026-07-21 live follow-up"](LIVE_VERIFICATION_v0.40.0-production-readiness.md#2026-07-21-live-follow-up-0420-cycle); #359 content-safety `400`→`ContentPolicyError` classification is unit-covered, not live-triggered [would require a deliberate policy violation]; #360/#362 are docs-only, verified by the documentation gates). Prior: [v0.41.0](LIVE_VERIFICATION_v0.41.0.md) (**#357 production-readiness hardening — stale-session fail-fast, free image gen, paid veo-lite T2V all proven live**). Prior: [v0.40.0](LIVE_VERIFICATION_v0.40.0.md) (**#344 `@`-mention asset-tagging resolution proven live e2e, ~2 Imagen credits** — `gflow character create` staged a real taggable character [bound reference images, `has_reference_images` guard], the e2e test's documented propagation wait cleared Flow's `projectInitialData` lag, and `gflow image t2i "@Zoro …"` passed with returncode 0, a real generated image, and the correctly de-tagged prompt in the catalog — no code changes needed, `resolve_and_apply` as merged in #344 already works end-to-end; pre-existing unrelated issue #174 [Flow media-library A/B flake] can still intermittently block generation regardless of this feature — recorded, not omitted). Prior: [v0.39.0](LIVE_VERIFICATION_v0.39.0.md) (**#341 failed-generation persistence proven live** — a real `image t2i` on denon82 failed at the wire [`batchGenerateImages` HTTP 400 → `WireFormatError`] and the record-on-catch funnel wrote the **first-ever `failed` row** into the production catalog [`error_type=wire-format`, redacted `error_detail`, browsable via `gflow data list errors`], **$0**; the remaining paid paths [video/chain/batch/movie/worker] are funnel-regression-tested, not force-failed live [would cost credits], and the status-aware `succeeded=false` video-poll fix is unit-locked — recorded, not omitted). Prior: [v0.38.1](LIVE_VERIFICATION_v0.38.1.md) (**#338 agentic-pin recovery proven live ON the pinned account** — run 1 caught the composer-render race the unit suite could not [`ensure_media_incomplete` +115 ms, toggle never reached]; the readiness-wait fix landed and run 2 recovered classic on denon82 after ~2h of pin [`ui_driver.bound mode=classic`, real 768×1376 JPEG, exact prompt adherence]; reload branch unit-locked, live trigger not observed this cycle — recorded, not omitted). Prior: [v0.38.0](LIVE_VERIFICATION_v0.38.0.md) (**#332 mode control + #314 i2i ref dedup proven live e2e** — `image t2i --ui-mode classic` recovered agentic→classic in a real run [`ui_mode.attempt_exit_agent` → full classic chain, 1376×768 JPEG]; two identical `image i2i` runs proved the dedup contract [run 1: picker miss → `image_uploaded`; run 2: `reference_deduped_by_filename`, ZERO uploads]; `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 15.2 MB `ftyp` mp4]; autopilot #333 recorded deferred-with-reason [hermes-ops deployment staged separately]). Prior: [v0.37.0](LIVE_VERIFICATION_v0.37.0.md) (**viewport 1920×1080 + agentic count enforcement + FIPS-safe SAPISIDHASH proven live e2e** — `image t2i` [classic cohort, real 1376×768 JPEG] and `video t2v` veo-fast [`MEDIA_GENERATION_STATUS_SUCCESSFUL`, 11.5 MB `ftyp` mp4] both succeeded end-to-end at the new 1920×1080 viewport with every selector resolving [no drift]; SAPISIDHASH digest verified byte-identical [FIPS-safe `usedforsecurity=False`], auth unchanged). Prior: [v0.36.0](LIVE_VERIFICATION_v0.36.0.md) (**#316 diagnostic tooling live-verified against real Flow traffic** — `GFLOW_CLI_HAR_PATH` captured a real 54-entry HAR [real Flow domains, 34× 200s, and a genuine 401 the tool exists to diagnose]; `GFLOW_CLI_DEBUG_TRACEBACK`'s typed-error scoping confirmed live [console output identical with/without the flag on a `GFlowError`]; unhandled-path behavior covered by 6 new tests (30 total across both files) + SDD task review; #312 reference-entity-smuggling fix covered by its own dedicated e2e test). Prior: [v0.35.0](LIVE_VERIFICATION_v0.35.0.md) (**#305-follow-up multimodal reverse-engineering & storyboard tool proven live e2e** — `gflow tools run storyboard` successfully deconstructed a cyberpunk scene into a cohesive 4-panel sequence; `reverse-engineer` tool extracts frames from video streams/URLs using `claude-video`'s `watch.py` and produces structured prompt components using Gemini multimodal models; dynamic token budgeting and strict Pyright types verified via test suite). Prior: [v0.34.0](LIVE_VERIFICATION_v0.34.0.md) (**#299 `--ui-mode` gate proven live, ZERO credits** — drove `get_ui_driver` directly over 4 real editor loads, never generated: bidirectional switch works [classic→agentic via `_force_agent_mode`, agentic→classic via `_exit_agent_mode`, each DOM-reverified], `agentic`-when-already-agentic is idempotent, and a timed-out toggle → **exit-28 fail-fast before submission**; deprecation behavior-change [`prefer_classic`→exit 28] confirmed). Prior: [v0.33.0](LIVE_VERIFICATION_v0.33.0.md) (**#287-follow-up picker fix proven live on the original repro** — the v0.32.1-failing `i2v <uuid> --project <crowded>` command now exits 0 with a real 3.0 MB `ftyp` mp4, `frame_ref_attached` + `video_saved`, zero uploads; **#241 jitter live-verified on both paths** — flag `--jitter 4-6` → `batch_jitter_sleep seconds=4.98`, and the new 0.5–1.5 s default → `seconds=1.47`, each firing exactly once between two t2i submissions; environment note: the denon82 cohort is now natively agentic and round-2 generations hit the pre-existing #281 `MediaAttributionError`, not a regression). Prior: [v0.32.1](LIVE_VERIFICATION_v0.32.1.md) (**#293 teardown fix live-verified credit-free** — error-path aborts leave ZERO chrome.exe holding the profile [3× leak reproduced pre-fix same day]; force-close fallback + ProfileLockedError translation unit-pinned; #283 wave logic fixes mock-verified to exact call counts). Prior: [v0.32.0](LIVE_VERIFICATION_v0.32.0.md) (**#287 UUID i2v frames proven live e2e** — an in-project asset selected by media UUID in the frame-slot dialog [frame_ref_attached, startImage bound on the wire, ZERO upload events] produced a real 720×1280 interpolation, resolving the #237 negative prior; foreign UUID → exit 9 pre-generation with screenshot; **#288 duration fail-fast proven live** — exit 23 pre-submit saved a 10-credit generation, and the debug screenshot confirmed the duration control is ABSENT from the cohort's settings popover [locale hypothesis refuted]; upload-400 exit-27 repro deferred-with-reason — the original rejected JPEG no longer exists). Prior: [v0.31.0](LIVE_VERIFICATION_v0.31.0.md) (**#281 wrong-media defenses live-verified in BOTH directions, credit-free** — correct attribution downloads with real wire metadata [seed, 768×1376]; the incident-class lazy-render ambiguity reproduced live and hard-stopped with `MediaAttributionError` exit 26 naming every candidate UUID, no file written; **#282 two-UUID-ref i2i proven e2e** — both freshly generated portrait UUIDs picker-selected into one scene with both canonical identities visually transferred). Prior: [v0.30.0](LIVE_VERIFICATION_v0.30.0.md) (**agentic-cohort image path + both fixes live-verified credit-free** — native 768×1376 stills, i2i-chain + canonical-ref identity hold; the character-create `DataIntegrityError` and the `prefer_classic` WARNING were observed live then fixed [recorder idempotent + INFO log]; MCP video-param feature deferred-with-reason on Veo credits, per the stills-only goal). Prior: [v0.29.0](LIVE_VERIFICATION_v0.29.0.md) (**persistent `gflow instructions` CRUD proven live e2e GREEN, credit-free** — 11-command sequence on a fresh project: add incl. `--ref <image-UUID>` attach, list/enable/disable, master toggle both ways, TOML `apply` destructive full-sync with `enabled=false` honored, `rm` with server card-id preserved across mutations; movie brief-sync code-path-verified via the same primitives, deferred-with-reason on credits; MCP `gflow_instructions_*` tools are thin adapters over the live-verified primitives). Prior: [v0.28.0](LIVE_VERIFICATION_v0.28.0.md) (**agent instructions `-i` now steer agentic generation — crayon e2e GREEN**: a style-neutral prompt + an enabled "crayon" card produced an unmistakable crayon drawing through the real transport; root causes were conversational phrasing + the `project_brief.enabled` master switch). Prior: [v0.27.1](LIVE_VERIFICATION_v0.27.1.md) (**v0.27.0 release follow-up fixes and documentation sync**). Prior: [v0.27.0](LIVE_VERIFICATION_v0.27.0.md) (**`[style]` block with named variants + prompt-aware resume — credit-free CLI verification**: real `movie run --dry-run` 3-way ledger proving resolved-style display, `skip (done)` on matching `style_hash`, and `re-run (style changed)` after a style edit; composition is local, wire path untouched, so no Veo credits spent — first credited styled run will confirm visually). Prior: [v0.26.0](LIVE_VERIFICATION_v0.26.0.md) (**image i2i by generated-image UUID proven live e2e GREEN** — the existing asset is *selected in place* by its media UUID, no duplicate upload, producing an i2i output that references it; plus generated-image `display_name` capture, credited @C1ph3r404). Prior: [v0.25.0](LIVE_VERIFICATION_v0.25.0.md) (**#237 remote-UUID i2v proven live e2e GREEN** — a real 8s 720×1280 interpolation from a generated image's UUID, after the picker-search attach was reworked to local upload; #240 home-`.env` matrix live; plus two silent-failure guards root-caused live: video-as-image download rejection and rejected-upload fail-loud). Prior: [v0.24.0](LIVE_VERIFICATION_v0.24.0.md) (--project parity across CLI + MCP — automated coverage; live gen auth-gated). Prior: [v0.23.0](LIVE_VERIFICATION_v0.23.0.md) (MCP generation wiring proven live end-to-end — tool→worker→real Flow REST→structured-error translation; final image-write blocked by an expired session, environmental. #222 macOS fix reporter-verified e2e on Apple Silicon). Prior: [v0.22.0](LIVE_VERIFICATION_v0.22.0.md) (Tools framework — automated/CI coverage complete; credit/key-gated live feature run is a pending owner gate, see the doc) · [v0.21.0](LIVE_VERIFICATION_v0.21.0.md) (MCP server over stdio + HTTP/SSE — credit-free protocol handshake; 4 tools / 2 prompts / 3 resources confirmed on stdout) · [v0.20.1](LIVE_VERIFICATION_v0.20.1.md) · [v0.20.0](LIVE_VERIFICATION_v0.20.0.md) · [v0.19.0](LIVE_VERIFICATION_v0.19.0.md) · [v0.18.0](LIVE_VERIFICATION_v0.18.0.md) · [v0.17.0](LIVE_VERIFICATION_v0.17.0.md) · [v0.16.0](LIVE_VERIFICATION_v0.16.0.md) · [v0.13.0](LIVE_VERIFICATION_v0.13.0.md) · [v0.12.0](LIVE_VERIFICATION_v0.12.0.md) · [v0.11.0](LIVE_VERIFICATION_v0.11.0.md) · [v0.10.0](LIVE_VERIFICATION_v0.10.0.md) · [v0.9.1](LIVE_VERIFICATION_v0.9.1.md) · [v0.9.0](LIVE_VERIFICATION_v0.9.0.md) · [v0.8.1](LIVE_VERIFICATION_v0.8.1.md) · [v0.7.0](LIVE_VERIFICATION_v0.7.0.md)
 **"Was the playwright upper bound raised, and on what evidence?"** → [LIVE_VERIFICATION_playwright_1.61](LIVE_VERIFICATION_playwright_1.61.md) (**`>=1.59.0,<1.60.0` → `>=1.61.0,<1.62.0` verified 2026-08-05, 1 Imagen + 1 Veo credit** — the 2026-08-03 regression that motivated the bound does NOT reproduce on 1.61.0: a live `i2v` drove the full chain with `image_uploaded status=200` → `frame_attached` → `generate_captured status=200` with `startImage` parsed, where **1.62.0 hung silently at exactly that upload step**; live `i2i` local-ref attach passed outright [96.7s]. **1.62.0 stays excluded** — never root-caused. Also found, A/B-proven pre-existing on BOTH 1.59.0 and 1.61.0: Flow dropped the duration-tab UI, so **`--duration` is currently broken for i2v** — `UiSelectorDriftError` fires correctly [refusing rather than silently accepting Flow's default, #288] but the selector needs re-deriving; that is why the i2v proof was driven via the CLI without `--duration`, and Flow's own server-side `PUBLIC_ERROR_VIDEO_GENERATION_TIMED_OUT` means no finished mp4 is claimed).
 **"Where is the reverse-engineered wire protocol for a feature?"** → the `*_RECON.md` design docs: [CHARACTER_RECON](CHARACTER_RECON.md) (Flow character entity protocol), [IMAGE_UPSCALE_RECON](IMAGE_UPSCALE_RECON.md) (`/v1/flow/upsampleImage` wire). Naming convention: one `<FEATURE>_RECON.md` per reverse-engineered surface, kept as the durable spec after the feature ships. Pre-capture research recons: [ASSET_TAGGING_RECON](ASSET_TAGGING_RECON.md) (`@`-mention asset tagging — shipped in v0.40.0, see [LIVE_VERIFICATION_v0.40.0](LIVE_VERIFICATION_v0.40.0.md)).
 **"What was live-verified for the data layer (PR #58)?"** → [LIVE_VERIFICATION_data_layer](LIVE_VERIFICATION_data_layer.md) — 1 Imagen + 1 Veo credit on denon82, 6-layer ledger (file + magic + Pillow + DB rows + CLI round-trip + structlog)

{gflow_cli-0.57.0 → gflow_cli-0.57.1}/docs/LIVE_VERIFICATION_v0.57.0.md

@@ -38,17 +38,21 @@
   signatures (the docs had drifted 4 params behind
   `mcp/tools.py`); a no-spend MCP-client config block (Option A2); a
   `GFLOW_MCP_NO_SPEND` section in `docs/CONFIGURATION.md` + two `docs/INDEX.md`
-  routing rows (the repo's own rule at `INDEX.md:151` requires both); `--no-spend`
+  routing rows (the repo's own rule under INDEX's *Documentation governance*
+  heading requires both); `--no-spend`
   on the `gflow mcp run` reference in `docs/USAGE.md`; `--ui-mode` and the exit-2/28
   behavior in `llms.txt`; the Security/Scorecard theme in `docs/PROJECT_STATUS.md`;
   the pin example bumped to `==0.57.0`; and **a same-release factual error in this
   changelog** — the Security entry described the triage image as pinning
   `node:20-slim` when #522 had already moved it to `node:26-slim` (the stale
   `Dockerfile.triage` line-1 comment was corrected too). Tier-3 deferred to a
-  follow-up issue (pre-existing, none introduced by this release): the
-  `--reference-entity`-on-video fiction (three docs plus the `t2v` help text claim
-  a flag that has shipped since v0.52.0 — and needs a maintainer decision on the
-  I2V contract, which `api/video.py:339` rejects), the Windows profile-path
+  follow-up issue **#531** (pre-existing, none introduced by this release): the
+  `--reference-entity`-on-video fiction (three docs plus the `t2v` help text
+  **deny** a flag that has in fact shipped since v0.52.0 and is registered on
+  t2v/i2v/r2v — and it needs a maintainer decision, because `api/video.py:339`
+  *rejects* `reference_entities` on I2V while `:366` omits it from the T2V guard,
+  so the same flag hard-errors on one mode and is silently accepted on another),
+  the Windows profile-path
   author segment (`%LOCALAPPDATA%\ffroliva\gflow-cli`) wrong in 6 docs + 2
   docstrings, the `ARCHITECTURE.md` testing-topology table naming three
   nonexistent test dirs, its missing driver/mode-control layer, module-inventory

gflow_cli-0.57.1/docs/LIVE_VERIFICATION_v0.57.1.md

@@ -0,0 +1,143 @@
+# Live verification — v0.57.1
+
+> Hand-run against real Flow on Windows 11, profile `denon82` (chrome strategy,
+> **pt-BR** — the #493 reporter's locale), 2026-08-14. Every check in this
+> release is **credit-free**: no Veo or Imagen generation was submitted at any
+> point. Recon that led to the fixes was additionally run on `ffroliva`.
+
+## Environment
+
+| | |
+|---|---|
+| Branch | `chore/release-v0.57.1` (off `develop` @ `6a3f5ff`) |
+| Local version | `0.57.1` editable |
+| Profiles | `denon82` (pt-BR) primary; `ffroliva` for the capability matrix |
+| Date | 2026-08-14 |
+| OS | Windows 11 |
+| Credits spent | **0** |
+
+## Pre-tag gates
+
+- Full offline suite: **3117 passed / 5 skipped / 89 deselected**.
+- `pyright src`: **78 = the accepted baseline** (`mcp/*` + `ui/app.py` only), no delta.
+- ruff check + `ruff format --check` (365 files), hygiene (754), doc links (29),
+  website PII (23), mirror in sync (18) — all green.
+- `/code-review xhigh`: **15 findings, all addressed** — including a hole where
+  `model is None` bypassed the new guard (so i2v's *default* path still failed)
+  and a shipped `gflow movie template` scaffold that raised at request
+  construction.
+- `/ponytail:ponytail-review`: **-330 lines** — two superseded spike scripts
+  deleted, a triplicated field tuple collapsed to one helper.
+- **e2e re-run AFTER the reviews and again AFTER the merge** (the review edits
+  touched guard code, so the earlier run was stale): `-m e2e_auth` **18 passed /
+  49 deselected** on merged `develop`, 117 s, zero credits.
+
+## Matrix
+
+| # | Feature | Variation | Result |
+|---|---|---|---|
+| 1 | #493 — expanded-sidebar recovery | real editor, pt-BR | ✅ composer restored |
+| 2 | #493 — reporter's cohort simulated | scoped close selector neutered | ✅ fallback rescues |
+| 3 | #493 — negative control | scoped **and** fallback neutered | ✅ does **not** recover |
+| 4 | #451/#288 — `--duration` on a Veo model | `t2v`/`i2v`/`r2v` × lite/fast/quality | ✅ exit 2, pre-browser |
+| 5 | #451/#288 — negative control | `--duration` on `omni-flash` | ✅ passes the guard |
+| 6 | `--reference-entity` surface | t2v / i2v / r2v | ✅ present / **absent** / present |
+| 7 | Model capability matrix | 5 models × 2 accounts × 2 locales | ✅ identical |
+
+## 1–3. #493 — the expanded chat sidebar (root cause)
+
+Reported as an unrecognized "third editor variant". It is not: **"Inicial"/"Final"
+are the Frames sub-mode's Start/End slots and the "Agente" pill is the ordinary
+Agent button** — both stock classic-composer features (owner screenshots).
+
+The real trigger is Flow's **expanded chat sidebar**, which removes the classic
+composer entirely. Measured live:
+
+| Layer | Evidence |
+|---|---|
+| Fingerprint | `crop_* triggers = 0` **and** `Agent pill = 0`, simultaneously |
+| Why exit 23 | no agentic indicator either → cohort detector matches nothing → drift, not the retryable exit 25 |
+| Recovery SPOF | the close X was scoped to the sidebar's `edit_square` affordance |
+| Locale | pt-BR reproduced identically — the cascade is ligature-keyed, not text |
+
+**A/B, three configurations** (`scripts/dev/capture_sidebar_state_dom.py`):
+
+| scoped selector | fallback | recovered? |
+|---|---|---|
+| works | present | yes (baseline) |
+| **broken** (reporter cohort) | present | **yes** — the fix |
+| **broken** | **broken** | **no** — proves the fallback rescues |
+
+The third row is what makes this a proof rather than a hope. Pinned by
+`tests/e2e/test_sidebar_recovery_e2e.py` (`e2e_auth`, $0) and unit tests using a
+`sidebar_unscoped` fake state.
+
+**Two hypotheses were refuted first, and are committed so they are not
+re-derived:** a `crop_free` sub-mode trigger (the trigger reflects the *aspect*,
+not the sub-mode) and a composer hydration race (a wait was written, A/B-neutered,
+cold loads passed 3/3 **both ways** — `_probe_selector_cascade` already waits 4 s
+per selector, so the wait was reverted rather than shipped).
+
+## 4–5. #451/#288 — `--duration` is model-conditional
+
+Flow's settings popover renders a duration row **only** for `omni_flash`; the
+Veo 3.1 models render none. `api/video.py` had claimed they "cap at 8s", which
+presumed a control that is never drawn — so `_select_video_duration` hunted a
+missing element and died with `UiSelectorDriftError` (exit 23) after ~30 s.
+
+That explains every symptom on those issues: it looked like drift, it reproduced
+identically on playwright 1.59 **and** 1.61 (correctly exonerating the version
+bound), and the locale hypothesis was correctly refuted. It was never either.
+
+```
+$ gflow video t2v "…" --model veo-lite --duration 8
+Error: --duration is not supported by --model veo-lite — Flow renders no duration
+control for it (verified live; refs #451/#288). Only omni-flash exposes a
+duration (4/6/8/10s). …
+$ echo $?
+2
+```
+
+Exit **2 before any browser work**, on all three commands × three Veo models
+(10 CLI tests). Negative control: `--model omni-flash --duration 6` **passes**
+the guard and proceeds — no over-reject.
+
+## 6. `--reference-entity` surface corrected
+
+The flag was registered on `t2v`/`i2v`/`r2v`, but `_validate_i2v_symmetry`
+rejects reference entities — so the i2v form raised for every caller who believed
+the help text. Now `t2v` ✅ · `i2v` ❌ · `r2v` ✅, verified by `--help`. The docs
+had the mirror-image error (three files plus the `t2v` help text denied a flag
+the CLI registered); all corrected.
+
+## 7. Model capability matrix
+
+Verified on **two accounts and two locales** — identical both times:
+
+| Model | Duration tabs | Credits | Ingredients |
+|---|---|---|---|
+| `omni_flash` | `4s` `6s` `8s` `10s` | 15 @10s / 12 @8s / 7 @4s | accepted |
+| `veo_3_1_lite` | none | 10 | accepted |
+| `veo_3_1_fast` | none | 20 | accepted |
+| `veo_3_1_quality` | none | 100 | **rejected** |
+
+Credits match exactly across accounts; `omni_flash` differs only by selected
+duration, which independently confirms **duration-scaled pricing**.
+
+## Not verified this cycle (recorded, not omitted)
+
+- **`veo_3_1_lite_lower_priority`** missed its picker selector on both accounts,
+  but the capture that would settle it was taken after the menu had closed —
+  **inconclusive**, so the selector was deliberately left untouched rather than
+  changed on a guess.
+- **`chain.py` per-link `duration`** aborts mid-run *after* earlier links are
+  billed, and `_resolve_chain_model` forces a Veo model, so chain durations are
+  invalid by construction. Needs manifest-level pre-validation before the run
+  starts — its own change, deferred with the finding recorded on #537.
+- Credit-spending e2e tiers (`e2e_image`, `e2e_video`) were **not** run: nothing
+  in this release touches a generation wire path, and every fix is verifiable at
+  $0.
+
+## Post-tag evidence
+
+To be appended after the tag push (release workflow result and PyPI publish).

{gflow_cli-0.57.0/website → gflow_cli-0.57.1}/docs/MCP.md

@@ -82,8 +82,8 @@ Both Click CLI (`src/gflow_cli/cli.py`) and MCP Server (`src/gflow_cli/mcp/`) ar
 The server registers three protocol surfaces:
 
 ### Tools (Executable actions)
-* `gflow_generate_image(prompt, model, aspect, count, seed, reference_images, tools, profile, project, project_name, instructions, ui_mode, output, wait)`: Triggers text-to-image / image-to-image (Imagen / Nano Banana). `instructions` is an optional list of ephemeral agent-instruction strings (agentic cohort only). `reference_images` switches to i2i and accepts **either a local file path or a generated image's Flow media UUID**. A UUID reference is attached by **selecting the already-existing asset in Flow's reference picker — no duplicate copy is uploaded** (locating the tile by the media id in its thumbnail URL, and searching the recorded display name to surface it when needed); gflow falls back to uploading the asset's on-disk local file only when it can't be located in place (e.g. it lives in a different project's picker). `project` generates into an existing Flow project id (mirrors CLI `--project`) — pass the reference's project to keep it selectable in place. `ui_mode` selects the Flow UI arm (`auto`/`classic`/`agentic`, mirroring CLI `--ui-mode`); passing `instructions` forces `agentic` automatically, so `ui_mode="classic"` + `instructions` is a hard conflict rather than a silent drop. See [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode).
-* `gflow_generate_video(prompt, mode, aspect, initial_frame, end_frame, reference_images, model, duration, count, tools, profile, project, project_name, ui_mode, output, wait)`: Triggers vertical or landscape video generation (Veo). `mode` is `t2v`/`i2v`/`r2v`; `model` (`veo_lite`/`veo_fast`/`veo_quality`/`omni_flash`, aliases accepted), `duration` (seconds), and `count` mirror the CLI `gflow video` flags — an omitted `model` lets the transport apply its i2v veo-lite default (issue #125), and `omni_flash` is rejected for i2v-with-frames; `i2v` requires `initial_frame`, `r2v` requires `reference_images`; `project` generates into an existing Flow project id (mirrors CLI `--project`). `initial_frame`, `end_frame`, and `reference_images` each accept **either a local file path or the Flow image UUID of a generated asset** — pass a generated image's id straight in to chain image→video, and gflow attaches it for you (the UUID is resolved to the asset's already-on-disk local file and uploaded as the frame; no manual download/re-upload step). A UUID that isn't in your local asset catalog is rejected up front with a clear "Reference Not Found" error; a catalogued asset whose local file is no longer on disk gives a "Reference Not On Disk" error (re-generate it or pass a local path). Note the CLI's semantics diverge here (#287): `gflow video i2v --initial-frame <UUID>` selects the asset **in the project's media picker with no upload** and needs no local catalog entry — so the same UUID input can succeed on one surface and fail on the other. `ui_mode` selects the Flow UI arm (#299 PR-A, mirroring CLI `--ui-mode`): video generation has **only a classic driver**, so `auto` ≡ `classic` — both verify the classic editor pre-submit and abort with exit 28 (zero credits) if it is unreachable — and `ui_mode="agentic"` is rejected with a 400 problem-details envelope, because no agentic video driver exists yet. See [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode).
+* `gflow_generate_image(prompt, model, aspect, count, seed, reference_images, tools, profile, project, project_name, instructions, ui_mode, output, wait)`: Triggers text-to-image / image-to-image (Imagen / Nano Banana). `instructions` is an optional list of ephemeral agent-instruction strings (agentic cohort only). `reference_images` switches to i2i and accepts **either a local file path or a generated image's Flow media UUID**. A UUID reference is attached by **selecting the already-existing asset in Flow's reference picker — no duplicate copy is uploaded** (locating the tile by the media id in its thumbnail URL, and searching the recorded display name to surface it when needed); gflow falls back to uploading the asset's on-disk local file only when it can't be located in place (e.g. it lives in a different project's picker). `project` generates into an existing Flow project id (mirrors CLI `--project`) — pass the reference's project to keep it selectable in place. `ui_mode` selects the Flow UI arm (`auto`/`classic`/`agentic`, mirroring CLI `--ui-mode`, matched case-insensitively); passing `instructions` forces `agentic` automatically, so `ui_mode="classic"` + `instructions` is a hard conflict rather than a silent drop. An unknown value returns a 400 problem-details envelope. See [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode).
+* `gflow_generate_video(prompt, mode, aspect, initial_frame, end_frame, reference_images, model, duration, count, tools, profile, project, project_name, ui_mode, output, wait)`: Triggers vertical or landscape video generation (Veo). `mode` is `t2v`/`i2v`/`r2v`; `model` (`veo_lite`/`veo_fast`/`veo_quality`/`omni_flash`, aliases accepted), `duration` (seconds), and `count` mirror the CLI `gflow video` flags — an omitted `model` lets the transport apply its i2v veo-lite default (issue #125), and `omni_flash` is rejected for i2v-with-frames; `i2v` requires `initial_frame`, `r2v` requires `reference_images`; `project` generates into an existing Flow project id (mirrors CLI `--project`). `initial_frame`, `end_frame`, and `reference_images` each accept **either a local file path or the Flow image UUID of a generated asset** — pass a generated image's id straight in to chain image→video, and gflow attaches it for you (the UUID is resolved to the asset's already-on-disk local file and uploaded as the frame; no manual download/re-upload step). A UUID that isn't in your local asset catalog is rejected up front with a clear "Reference Not Found" error; a catalogued asset whose local file is no longer on disk gives a "Reference Not On Disk" error (re-generate it or pass a local path). Note the CLI's semantics diverge here (#287): `gflow video i2v --initial-frame <UUID>` selects the asset **in the project's media picker with no upload** and needs no local catalog entry — so the same UUID input can succeed on one surface and fail on the other. `ui_mode` selects the Flow UI arm (#299 PR-A, mirroring CLI `--ui-mode`) and **applies to every mode of this tool, including `r2v`** — unlike the CLI, where `video r2v`/`chain` have no flag and follow the env-only path. Video generation has **only a classic driver**, so `auto` ≡ `classic`: both verify the classic editor pre-submit and abort before spending credits if it is unreachable. `ui_mode="agentic"` is rejected with a 400 problem-details envelope, because no agentic video driver exists yet. Values are matched case-insensitively. (MCP tools return envelopes, never process exit codes — the CLI equivalents of these aborts are exit 28 and exit 2 respectively.) See [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode).
 * `gflow_auth_status(profile)`: Credit-free, non-interactive Flow session probe (#497) — wraps the same fail-closed `verify_flow_profile` check as `gflow auth status`. Returns `{"status": "authenticated", "profile", "user_email"}` or a problem-details error with a `remediation_hint`; a `verification_error` outcome means a network/endpoint problem, which re-login does not fix. Call it before a generation tool to fail fast on dead auth (the queue is async — without it, an auth failure surfaces only later from the daemon). Login/logout remain CLI-only (genuinely interactive).
 * `gflow_list_projects(profile, limit, offset)`: Queries the SQLite catalog for recent generation folders, paginated — the response carries `count` (rows in this page), `offset`, `has_more`, and `next_offset` (pass it back as `offset` for the next page; `null` on the last page).
 * `gflow_list_tools()`: Lists the prompt tools (name/title/description/category) accepted by the generate tools' `tools` param.
@@ -180,7 +180,7 @@ Use this if you installed `gflow-cli` globally (e.g. via `uv tool install gflow-
 }
 ```
 
-##### Option A2: Read-only server (`--no-spend`)
+##### Option A2: Read-only server
 
 Use this when the agent must never be able to spend credits (#496). The two
 credit-spending tools (`gflow_generate_image`, `gflow_generate_video`) are then
@@ -243,6 +243,9 @@ Use this if you cloned the repository locally and run it via `uv`:
 For decoupled clients, local web interfaces, or multi-process frontends, run the daemon as an HTTP service:
 ```bash
 gflow serve --port 8000 --host 127.0.0.1 --profile default
+
+# Read-only daemon — the two credit-spending tools are never registered (#496):
+gflow serve --port 8000 --host 127.0.0.1 --profile default --no-spend
 ```
 This serves the MCP server over **Streamable HTTP**, the current spec transport:
 * **Endpoint:** `http://127.0.0.1:8000/mcp`

{gflow_cli-0.57.0 → gflow_cli-0.57.1}/docs/PROJECT_STATUS.md

@@ -4,8 +4,33 @@
 
 ## Current release
 
+**v0.57.1 — alpha.** **Two long-open UI bugs root-caused from live evidence (#493, #451/#288).**
+#493 was reported as an unrecognized "third editor variant"; it is not. Flow's
+**expanded chat sidebar** removes the classic composer entirely — no `crop_*`
+settings trigger *and* no Agent pill — which is one state producing both reported
+symptoms, and why the failure surfaced as `UiSelectorDriftError` (exit 23) rather
+than the retryable agentic error: with no agentic indicator on screen, the cohort
+detector matched nothing. Recovery hinged on a close button scoped to the
+sidebar's `edit_square` affordance, so a cohort lacking that ligature could never
+recover; `ensure_media_mode` now falls back to an unscoped close from the
+demonstrably stuck state, A/B-proven live. #451/#288 were never selector drift
+either: Flow's settings popover is **model-conditional** — only `omni-flash`
+renders a duration row — so `--duration` on a Veo model hunted a control that is
+never drawn. It now fails at the CLI edge with exit 2 before any browser work.
+Also: `--reference-entity` no longer advertised on `video i2v` (its DTO always
+rejected it), a typed `ReferenceNotFoundError` (exit 32) replaces a bare
+Playwright timeout, and `gflow models` stops advertising a duration users cannot
+set. Everything verified at **zero credits**. See
+[LIVE_VERIFICATION_v0.57.1.md](LIVE_VERIFICATION_v0.57.1.md).
+
+<details><summary>v0.57.0 — video joins the UI-mode policy + MCP truthfulness wave</summary>
+
 **v0.57.0 — alpha.** **Video joins the UI-mode policy (#299) + an MCP truthfulness wave (#496–#501).** `gflow video t2v`/`i2v` and MCP `gflow_generate_video` now take `--ui-mode`/`ui_mode` and bind their driver through `get_ui_driver` after editor mount instead of a hardcoded classic bind; video has only a classic driver, so `auto` ≡ `classic`, an env-sourced `agentic` degrades with a warning, and an explicit `--ui-mode agentic` is refused with exit 2 before any browser work. When Flow serves the agentic editor and classic cannot be recovered, video now fails fast pre-submit (`UiModeUnavailableError`, exit 28, zero credits) instead of burning 30–40 s of doomed selector timeouts. The agentic direction was hardened to match the classic one: `mode_control.ensure_agent_mode` replaces `_force_agent_mode` (deleted) with real-click-first + `aria-pressed` verification, no `tune`-ligature check, unknown editor variants no-op with a warning, and the sanctioned reload carries an explicit 15 s timeout. On the MCP side: `gflow mcp run --no-spend` (#496) unregisters both generate tools so an agent cannot even see them; `gflow_auth_status` (#497) gives agents a credit-free pre-flight session probe; `gflow_list_projects` paginates honestly with `offset`/`has_more`/`next_offset` (#498); the stub `gflow_list_characters` — which always answered "no characters", an active lie — is gone (#499); and `gflow://docs/known-issues` is bounded to a small index plus a per-issue templated read (#501) instead of injecting ~70 KB on every read. On the supply-chain side the release finishes the Scorecard hardening tail: every workflow now runs with a least-privilege token and every `uses:` action is pinned to a full commit SHA, the remaining in-workflow package installs are hash- or digest-pinned (`website/requirements.txt`, `Dockerfile.triage`, `pip-audit`), CI enforces a test-count floor so "a green build that ran nothing" cannot pass, `check_repo_hygiene.py` fails on version disagreement between `pyproject.toml`/`__init__.py`/`plugin.json`, and a self-run OpenSSF Scorecard workflow publishes the score as a README/website badge with a [SECURITY.md](SECURITY.md) section explaining it. Everything in this release was verified at **zero credits**. See [LIVE_VERIFICATION_v0.57.0.md](LIVE_VERIFICATION_v0.57.0.md).
 
+</details>
+
+**Develop (unreleased, post-v0.57.1):** post-release doc-review fixes only — see `CHANGELOG.md` `[Unreleased]` for the authoritative list. `develop` is the staging branch for the next release; this line is not a substitute for the changelog.
+
 <details><summary>v0.56.0 — ops-hardening batch + honest mode-switch evidence (#477/#478/#479, #493)</summary>
 
 **v0.56.0 — alpha.** **Ops-hardening batch (#477/#478/#479) + honest mode-switch evidence (#493).** A Chromium major-version downgrade guard refuses to open a persisted profile with an older bundled engine than last wrote it (`ProfileEngineDowngradeError`, exit 11 — pre-auth, pre-credits) instead of letting Chromium's downgrade cleanup shred the session store; `GFLOW_CLI_LEASE_WAIT_SECONDS=N` adds an opt-in bounded wait on same-profile lease contention (default keeps the historical fail-fast); a once-a-day cache-served PyPI check prints a one-line stderr notice when a newer gflow-cli exists; and the exit-23 mode-switch fall-through now states that no known Flow cohort matched (the third, unrecognized editor layout from #493) while the drift remediation names the artifacts runs actually produce (`diag_mode_switch_miss.json`, the referenced screenshot, the incident bundle) instead of a phantom "debug screenshot from this message". Guard, lease wait, and the mode-switch path were live-verified; #479's notice is deferred-with-reason to a post-release check (it needs a published newer version on PyPI). See [LIVE_VERIFICATION_v0.56.0.md](LIVE_VERIFICATION_v0.56.0.md).
@@ -60,7 +85,6 @@
 
 </details>
 
-**Develop (unreleased, post-v0.57.0):** *(empty — develop is the staging branch for the next release).*
 
 <details><summary>v0.46.0 — prompt tools on any OpenAI-compatible endpoint (#387)</summary>